linux-stable.git/drivers/staging/android, branch v4.17.2

staging: android: ion: Switch to pr_warn_once in ion_buffer_destroy

2018-06-16T07:18:20+00:00

commit 45ad559a29629cb1c64ee636563c69b71524f077 upstream.

Syzbot reported yet another warning with Ion:

WARNING: CPU: 0 PID: 1467 at drivers/staging/android/ion/ion.c:122
ion_buffer_destroy+0xd4/0x190 drivers/staging/android/ion/ion.c:122
Kernel panic - not syncing: panic_on_warn set ...

This is catching that a buffer was freed with an existing kernel mapping
still present. This can be easily be triggered from userspace by calling
DMA_BUF_SYNC_START without calling DMA_BUF_SYNC_END. Switch to a single
pr_warn_once to indicate the error without being disruptive.

Reported-by: syzbot+cd8bcd40cb049efa2770@syzkaller.appspotmail.com
Reported-by: syzbot 
Signed-off-by: Laura Abbott 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman

drivers:staging:android:ashmem: Changing return type from int to loff_t

2018-03-19T18:43:24+00:00

Changing return type from int to loff_t. Actual return type of the
function (vfs_llseek) is loff_t (long long). Here due to implicit
converion from long long to int, result will be implementation defined.

Signed-off-by: Rohit Kumar 
Signed-off-by: Greg Kroah-Hartman

staging: android: ion: Update wording in drivers/staging/android/ion/Kconfig

2018-03-19T18:43:24+00:00

Changes the usage of the word 'Chose' to 'Choose' in the ION
Memory Manager Kconfig.

Signed-off-by: Phillip Potter 
Acked-by: Laura Abbott 
Signed-off-by: Greg Kroah-Hartman

Merge 4.16-rc6 into staging-next

2018-03-19T05:47:01+00:00

We want the staging fixes in here as well to handle merge/test issues.

Signed-off-by: Greg Kroah-Hartman

staging: android: ashmem: Fix possible deadlock in ashmem_ioctl

2018-03-06T15:21:10+00:00

ashmem_mutex may create a chain of dependencies like:

CPU0                                    CPU1
 mmap syscall                           ioctl syscall
 -> mmap_sem (acquired)                 -> ashmem_ioctl
 -> ashmem_mmap                            -> ashmem_mutex (acquired)
    -> ashmem_mutex (try to acquire)       -> copy_from_user
                                              -> mmap_sem (try to acquire)

There is a lock odering problem between mmap_sem and ashmem_mutex causing
a lockdep splat[1] during a syzcaller test. This patch fixes the problem
by move copy_from_user out of ashmem_mutex.

[1] https://www.spinics.net/lists/kernel/msg2733200.html

Fixes: ce8a3a9e76d0 (staging: android: ashmem: Fix a race condition in pin ioctls)
Reported-by: syzbot+d7a918a7a8e1c952bc36@syzkaller.appspotmail.com
Signed-off-by: Yisheng Xie 
Signed-off-by: Greg Kroah-Hartman

staging: android: ashmem: Fix lockdep issue during llseek

2018-03-01T16:37:07+00:00

ashmem_mutex create a chain of dependencies like so:

(1)
mmap syscall ->
  mmap_sem ->  (acquired)
  ashmem_mmap
  ashmem_mutex (try to acquire)
  (block)

(2)
llseek syscall ->
  ashmem_llseek ->
  ashmem_mutex ->  (acquired)
  inode_lock ->
  inode->i_rwsem (try to acquire)
  (block)

(3)
getdents ->
  iterate_dir ->
  inode_lock ->
  inode->i_rwsem   (acquired)
  copy_to_user ->
  mmap_sem         (try to acquire)

There is a lock ordering created between mmap_sem and inode->i_rwsem
causing a lockdep splat [2] during a syzcaller test, this patch fixes
the issue by unlocking the mutex earlier. Functionally that's Ok since
we don't need to protect vfs_llseek.

[1] https://patchwork.kernel.org/patch/10185031/
[2] https://lkml.org/lkml/2018/1/10/48

Acked-by: Todd Kjos 
Cc: Arve Hjonnevag 
Cc: stable@vger.kernel.org
Reported-by: syzbot+8ec30bb7bf1a981a2012@syzkaller.appspotmail.com
Signed-off-by: Joel Fernandes 
Acked-by: Greg Hackmann 
Signed-off-by: Greg Kroah-Hartman

Merge 4.16-rc3 into staging-next

2018-02-26T14:32:00+00:00

We want the IIO/Staging fixes in here, and to resolve a merge problem
with the move of the fsl-mc code.

Signed-off-by: Greg Kroah-Hartman

staging: android: ion: Remove check of idev->debug_root

2018-02-22T13:53:05+00:00

We will go on initial idev if failed to create debug_root, and it does
not matter to check the return value of this debugfs call, just remove it.

Signed-off-by: Yisheng Xie 
Signed-off-by: Greg Kroah-Hartman

staging: android: ion: Remove check of debug_file

2018-02-22T13:53:05+00:00

There's no need to check the return value of debug_file for it is just a
debugfs and we will go on the following process if we failed to create
debug_file. So just remove it.

Signed-off-by: Yisheng Xie 
Signed-off-by: Greg Kroah-Hartman

staging: android: ion: Initialize dma_address of new sg list

2018-02-20T08:05:35+00:00

Fix the dup_sg_table function to initialize the dma_address of the new
sg list entries instead of the source dma_address entries.

Since ION duplicates the sg_list this issue does not appear to result in
an actual bug.

Signed-off-by: Liam Mark 
Acked-by: Laura Abbott 
Signed-off-by: Greg Kroah-Hartman